Pipenv requirements for `--dev-only` may include packages from other categories

[stekycz]

Issue description

Executing pipenv requirements --from-pipfile --dev-only generates the requirements format properly but in some cases includes additional packages from other categories (primarily default).

Expected result

I would expect only packages listed in dev-packages to be listed in the requirements format when using --dev-only option.

Actual result

A package from default category (or generally any category) is included in the list of --dev-only output.

Steps to replicate

1. Prepare an empty folder with Pipfile with the following content

[packages]
iniconfig = "==2.1.0"

[dev-packages]
pytest = "==8.4.1"

2. Install

PIPENV_VENV_IN_PROJECT=1 pipenv install

4. Generate --dev-only requirements

pipenv requirements --from-pipfile --dev-only

5. Notice the extra iniconfig package listed

---

I believe the package is listed because it is a sub-dependency (possibly transitively) of pytest but the current logic only cares about the package being explicitly listed in any category in the Pipfile.

I believe each category and the specific dev branch should care about packages listed in their category only:

• https://github.com/pypa/pipenv/blob/main/pipenv/routines/requirements.py#L38
• https://github.com/pypa/pipenv/blob/main/pipenv/routines/requirements.py#L46

It can probably apply the other direction as well

• https://github.com/pypa/pipenv/blob/main/pipenv/routines/requirements.py#L55

---

$ pipenv --support

Pipenv version: '2025.0.4'

Pipenv location: '/opt/homebrew/Cellar/pipenv/2025.0.4/libexec/lib/python3.13/site-packages/pipenv'

Python location: '/opt/homebrew/Cellar/pipenv/2025.0.4/libexec/bin/python'

OS Name: 'posix'

User pip version: '25.1.1'

user Python installations found:

• 3.10.14: ~/.pyenv/versions/3.10.14/bin/python3
• 3.10.14: ~/.pyenv/versions/3.10.14/bin/python
• 3.9.6: /usr/bin/python3

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '3.13.8',
 'os_name': 'posix',
 'platform_machine': 'arm64',
 'platform_python_implementation': 'CPython',
 'platform_release': '24.6.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 24.6.0: Mon Aug 11 21:16:31 PDT '
                     '2025; root:xnu-11417.140.69.701.11~1/RELEASE_ARM64_T6030',
 'python_full_version': '3.13.8',
 'python_version': '3.13',
 'sys_platform': 'darwin'}

System environment variables:

• ...

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: ...
• SHELL: /bin/zsh
• PWD: ...

---

Contents of Pipfile ('.../Pipfile'):

[packages]
iniconfig = "==2.1.0"

[dev-packages]
pytest = "==8.4.1"

Contents of Pipfile.lock ('.../Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "5f353a2b2243d20ef357f102ac765af12b1804407af218fae273c0097baa72b7"
        },
        "pipfile-spec": 6,
        "requires": {},
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.org/simple",
                "verify_ssl": true
            }
        ]
    },
    "default": {
        "iniconfig": {
            "hashes": [
                "sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd25c2645f63c773e1c7",
                "sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760"
            ],
            "index": "pypi",
            "markers": "python_version >= '3.8'",
            "version": "==2.1.0"
        }
    },
    "develop": {
        "iniconfig": {
            "hashes": [
                "sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd25c2645f63c773e1c7",
                "sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760"
            ],
            "index": "pypi",
            "markers": "python_version >= '3.8'",
            "version": "==2.1.0"
        },
        "packaging": {
            "hashes": [
                "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484",
                "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f"
            ],
            "markers": "python_version >= '3.8'",
            "version": "==25.0"
        },
        "pluggy": {
            "hashes": [
                "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3",
                "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746"
            ],
            "markers": "python_version >= '3.9'",
            "version": "==1.6.0"
        },
        "pygments": {
            "hashes": [
                "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887",
                "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b"
            ],
            "markers": "python_version >= '3.8'",
            "version": "==2.19.2"
        },
        "pytest": {
            "hashes": [
                "sha256:539c70ba6fcead8e78eebbf1115e8b589e7565830d7d006a8723f19ac8a0afb7",
                "sha256:7c67fd69174877359ed9371ec3af8a3d2b04741818c51e5e99cc1742251fa93c"
            ],
            "index": "pypi",
            "markers": "python_version >= '3.9'",
            "version": "==8.4.1"
        }
    }
}

[matteius]

the package is listed because it is a sub-dependency (possibly transitively) of pytest.

If that is the cacse, then yes, that is expected. Are you looking for a more minimal pipenv requirements output?

[stekycz]

I am looking for requirements generated based on the list of packages in Pipfile in each category only without any additional packages.

My understanding of the --from-pipfile option is that it should really generate only those without any transitive dependencies. By default, I would expect only a list of production (the default category) packages listed without interference with dev packages and in combination with --dev-only I would expect a list of dev dependencies only without anything listed in the default category.

I am using here dev and production dependencies as probably the most common pattern but I believe it manifests among any categories when used.

I work with assumption that a dependency should be listed in only one category here. However, I admit that is a context specific assumption. If that assumption is not correct, a dependency defined within Pipfile among multiple categories should definitely occur in all of them but not in any category requirements output that does not explicitly define it when --from-pipfile option is used.